BayThreat was awesome, do it again! – mckeay.net
Which is why smaller, local events like BayThreat, DojoCon and BSides are becoming so important to security professionals around the globe; the ability to go to a small, local event far outstrips the cost to value ratio of any of the big cons and it’s so much easier to actually see the speakers you want to see.

Resources:

Course Review: Cracking the Perimeter by Offensive Security – ethicalhacker.net
Building on material in the earlier course, Pentesting with Backtrack (PWB – Read Review), this offering provides intermediate students with a learning platform that can be used to become advanced practitioners of certain exploit methodologies.

DNS Tampering and Root Servers – renesys.com
Enable DNSSEC. Don’t pass your queries across the GFW (if you can help it). If your government requires DNS-based technical controls, install them at the resolver.

SQLi filter evasion cheat sheet (MySQL) – websec.wordpress.com
This week I presented my experiences in SQLi filter evasion techniques that I have gained during 3 years of PHPIDS filter evasion at the CONFidence 2.0 conference.

Tools:

Runasil – didierstevens.com
Because I didn’t find a program to start an application with a given integrity level from “Image File Execution Options”, I wrote runasil.

JavaSnoop 1.0 FINAL released! – i8jesus.com
After 6 release candidates, roughly a thousand bugs fixed, dozens of improvements and features added, I finally think the tool is ready for general availability.

j0llydmper – code.google.com/p/j0llydmper/
j0llydmper is a windows service that allows you to dump furtively and automaticaly some content of USB disks just plugged in your computer.

Bluelog v0.9.8 – digifail.com
Bluelog is a Linux Bluetooth scanner written to do a single task, log devices that are in discoverable mode. It is intended to be used as a site survey tool, determining how many discoverable Bluetooth devices there are in a given environment.

OVF Tool Documentation – vmware.com
VMware OVF Tool is a command-line utility that allows you to import and export OVF packages to and from a wide variety of VMware platform products.

VIDigger v1.0 – layeredsec.com
VIDigger is designed to help administrators check the configuration of ESX server and the virtual machines hosted on ESX server against the VMware Infrastructure Hardening guide and other best practices.”

Browser Exploitation Framework v.0.4.2 – code.google.com/p/beef/
It allows the experienced penetration tester or system administrator additional attack vectors when assessing the posture of a target.

owasp-dos-http-post – code.google.com/p/owasp-dos-http-post/
This tool was created and released GPLv3 Open Source for performance testing of systems and controls.

Techniques:

The USB Stick O’ Death – spareclockcycles.org
I’ve recently been researching and experimenting with USB malware, and I wanted to take a shot at developing my own malicious USB stick.

Avoiding AV Detection – spareclockcycles.org
My main goal in this research was to see how much effort it would take to become undetectable again, and the answer was ‘virtually none’.

Firefox 3.6.13: damn you, corner cases – lcamtuf.blogspot.com
As you may recall, one of the more significant shortcomings of the same-origin policy is that it does not give any guidance on handling documents with no inherent origin associated – that is, it fails to account for all the content coming from about:, data:, file:, and similar pseudo-URLs.

On the effectiveness of DEP and ASLR – technet.com
DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) have proven themselves to be important and effective countermeasures against the types of exploits that we see in the wild today.

More updates (including RAR) – golubev.com
Obviously it isn’t possible to reach with 83.5% utilization, so I’ve made some tests with 5xMD5 again and this time speed-up is here.

Vulnerabilities:

Canon Original Data Security System Vulnerability – elcomsoft.com
The credibility of photographic evidence becomes vital in numerous situations for insurance companies and courts, as they may accept digital image as indisputable evidence if it can be proven genuine.

Vendor/Software Patches:

New version of OpenSSL fixes two vulnerabilities – h-online.com
A flaw in an older workaround for Netscape browsers and servers can be remotely exploited to make an OpenSSL server downgrade the ciphersuite to a weaker one for subsequent connections.

Other News:

Large US hosting provider hit in web attack – sophos.com
When innocent users browse these sites, the injected JavaScript adds an iframe element to the page in order to load further malicious content from a remote site.

Lab Matters: The Dark Side of Jailbreaking iPhones – securelist.com
In this Q&A with Ryan Naraine, Raiu talks about the Jailbreakme.com vulnerability and exploit and the social engineering techniques used to take advantage of the popularity of jailbreaking utilities.

History stealing by ad networks has got everyone afluster
Researchers have discovered that dozens of Web sites are using simple Javascript tricks to snoop into visitors’ Web browsing history.

Top Abuses of Open Web Proxies – zscaler.com
While there is nothing new or Earth-shattering in this post, I thought I’d share what I have seen as the top abuses of open web proxies – as this is an everyday occurrence involving a large volume of web transactions and is a constant annoyance on the Internet.

OWASP 4.0 – owasp.blogspot.com
The time has come to measure our success not by the number of members, projects, and conferences, but by whether we are succeeding at making the world’s software more secure.

Fix to Chinese Internet traffic hijack due in January – networkworld.com
Policymakers disagree about whether the recent Chinese hijacking of Internet traffic was malicious or accidental, but there’s no question about the underlying cause of this incident: the lack of built-in security in the Internet’s main routing protocol.

DHS, NIST, Financial Services Group Form Security Research Partnership – threatpost.com
As the finger-pointing and name-calling surrounding the WikiLeaks issue continue in Washington, the White House this week facilitated a cooperative agreement among several key public and private organizations designed to spur joint information security research projects.

US Military Bans Physical Media To Curb Leaks – techcrunch.com
Ironically, the news comes via a leaked memo obtained by Wired’s Danger Room that insists that everyone from grunts to techs “immediately cease use of removable media on all systems, servers, and stand alone machines residing on SIPRNET,” under pain of court-martial.

Leave A Comment

About Us

Infosec Events is dedicated to the growing information security industry. We strive to provide useful information and resources to those in the industry. Don't hesitate to contact us should you need anything.